CVE-2026-5974

CVE-2026-5974 is an operating system command injection vulnerability affecting FoundationAgents MetaGPT versions up to 0.8.1, specifically in the Bash.run function within the metagpt/tools/libs/terminal.py library. The flaw allows attackers to execute arbitrary system commands through the vulnerable function. The vulnerability carries a CVSS 3.1 score of 7.3 (HIGH) with a network-based attack vector requiring no authentication or user interaction. Attack complexity is low, and successful exploitation could result in confidentiality, integrity, and availability impacts to the affected system. The EPSS score of 0.0176 indicates relatively low probability of exploitation in the wild compared to other known vulnerabilities. There is currently no evidence of active exploitation, and the vulnerability does not appear on the Known Exploited Vulnerabilities (KEV) catalog. The project maintainers were notified early through a pull request but have not yet taken responsive action. Community attention remains low, suggesting limited public awareness of this issue at this time.